Mon 24 Jul 2017 03:53:42 AM UTC, comment #11:
I cleaned up the patch to use more modern C++11 syntax and then pushed it here (http://hg.savannah.gnu.org/hgweb/octave/rev/10136bfd46a3). Closing report.
|
Mon 24 Jul 2017 12:51:15 AM UTC, comment #10:
With the patch applied it passes the test.
Dmitri.
--
|
Mon 24 Jul 2017 12:36:30 AM UTC, comment #9:
I reviewed lex.ll and the heap buffer overflow supposedly occurs with a read supposedly on this line of code.
I suspect that it actually is the line before, but the error reporting is slightly off.
This could cause a problem if, for example, current_input_line was empty so that the length was 0. In this case the index would be [-1] which could trigger this.
To debug this I modified the code slightly (there is a diff attached to the bug report). Could you apply the diff with "patch -p1 < lex.diff", rebuild, and then run "test liboctave/array/Sparse.cc-tst" as before. Even if it segfaults, I expect the diagnostics will be better and be localized to the 'char c' line.
(file #41308)
|
Sun 23 Jul 2017 12:31:27 AM UTC, comment #8:
Attached.
Dmitri.
--
(file #41293)
|
Sun 23 Jul 2017 12:25:32 AM UTC, comment #7:
I'm using gcc 5.4 which explains why I'm not getting the "stack-use-after-scope" warnings.
The first heap buffer overflow (from Sparse.cc-tst) is
Could you upload lex.ll so that I can match the exact source code against the error report?
|
Sat 22 Jul 2017 06:00:55 PM UTC, comment #6:
I think you need at least gcc 7 to get "stack-use-after-scope" diagnostic:
https://gcc.gnu.org/gcc-7/changes.html
Dmitri.
--
|
Sat 22 Jul 2017 05:56:33 PM UTC, comment #5:
On "test libinterp/octave-value/ov-class.cc-tst" I get
which I assume is false positive per the HINT.
(I get this error in many tests).
Dmitri.
--
|
Sat 22 Jul 2017 05:41:33 PM UTC, comment #4:
HG ID for this build is "d891b6a16a4d"
'-fno-omit-frame-pointer' seems to help with diagnostic (gives line numbers). But the errors still there.
Also the same in
and few others like that.
Dmitri.
--
(file #41291)
|
Sat 22 Jul 2017 05:07:35 PM UTC, comment #3:
I built it without java, qt, and fltk.
I will try with '-enable-address-sanitizer-flags'.
Dmitri.
--
|
Sat 22 Jul 2017 05:02:44 PM UTC, comment #2:
Instead of changing the CXXFLAGS manually, I configured with '-enable-address-sanitizer-flags'. This also adds '-fno-omit-frame-pointer'. I don't get a segfault in ov-fcn-handle.cc, but I do get one in test libinterp/octave-value/ov-class.cc-tst. Using gdb, the problem seems to be within the Java JVM: /usr/lib/jvm/java-8-openjdk-amd64/jre/lib/amd64/server/libjvm.so.
|
Sat 22 Jul 2017 12:28:38 AM UTC, comment #1:
The same (?) problem shows up in some other tests:
|
Sat 22 Jul 2017 12:00:11 AM UTC, original submission:
compiled with fsanitize=address.
Running
results in
Full error log is attached.
Dmitri.
--
|